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SOCIAL  SECURITY  NUMBER  PROTECTION  ACT  OF  2007 


June  13,  2007.— Ordered  to  be  printed 


Mr.  DiNGELL,  from  the  Committee  on  Energy  and  Commerce, 
submitted  the  following 

REPORT 

[To  accompany  H.R.  948] 
[Including  cost  estimate  of  the  Congressional  Budget  Office] 

The  Committee  on  Energy  and  Coromerce,  to  whom  wa«  referred 
the  bill  (H.R.  948)  to  strengthen  the  authority  of  the  Federal  Gov- 
ernment to  protect  individuals  from  certain  acts  and  practices  in 
the  sale  and  purchase  of  Social  Security  numbers  and  Social  Secu- 
rity account  numbers,  and  for  other  purposes,  having  considered 
the  same,  report  favorably  thereon  with  an  amendment  and  rec- 
ommend that  the  bill  as  amended  do  pass. 
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AMENDMENT 

The  amendment  is  as  follows: 

Strike  all  after  the  enacting  clause  and  insert  the  following: 

SECTION  1.  SHORT  TITLE. 

This  Act  may  be  cited  as  the  "Social  Security  Number  Protection  Act  of  2007". 

SEC.  2.  DEFINITIONS. 

In  this  Act: 

(1)  Commission. — The  term  "Commission"  means  the  Federal  Trade  Commis- 
sion. 

(2)  Person. — The  term  "person"  means  any  individual,  partnership,  corpora- 
tion, trust,  estate,  cooperative,  association,  or  any  other  entity. 

(3)  Sale. — The  term  "sale"  means  obtaining,  directly  or  indirectly,  an)rthing 
of  value  in  exchange  for  a  Social  Security  number.  Such  term  does  not  include 
the  submission  of  such  numbers  as  part  of  the  process  for  applying  for  any  type 
of  Government  benefit  or  programs  (such  as  grant  or  loan  applications  or  wel- 
fare or  other  public  assistance  programs).  Such  term  also  does  not  include 
transfers  of  such  numbers  as  part  of  a  data  matching  program  under  the  Com- 
puter Matching  and  Privacy  Protection  Act. 

(4)  Purchase. — The  term  "purchase"  means  providing  directly  or  indirectly, 
anything  of  value  in  exchange  for  a  Social  Security  number.  Such  term  does  not 
include  the  submission  of  such  numbers  as  part  of  the  process  for  applying  for 
any  type  of  Government  benefit  or  programs  (such  as  grant  or  loan  applications 
or  welfare  or  other  public  assistance  programs).  Such  term  also  does  not  include 
transfers  of  such  numbers  as  part  of  a  data  matching  program  under  the  Com- 
puter Matching  and  Privacy  Protection  Act. 

(5)  Social  security  number. — The  term  "Social  Security  number"  means  the 
social  security  account  number  assigned  to  an  individual  under  section 
205(c)(2)(B)  of  the  Social  Security  Act  (42  U.S.C.  405(c)(2)(B)). 

(6)  State. — The  term  "State"  means  any  State  of  the  United  States,  the  Dis- 
trict of  Columbia,  Puerto  Rico,  the  Northern  Mariana  Islands,  the  United  States 
Virgin  Islands,  Guam,  American  Samoa,  and  any  territory  or  possession  of  the 
United  States. 

sec.  3.  PROHIBITION  ON  CERTAIN  USES  OF  SOCIAL  SECURITY  NUMBERS. 

(a)  Prohibition. — Except  as  provided  under  regulations  issued  by  the  Commission 
under  subsection  (c),  it  shall  be  unlawful  for  any  person  to — 

(1)  intentionally  display  the  Social  Security  number  of  another  individual  on 
a  website  that  is  generally  accessible  to  the  public  or  provide  an  individual  with 
access  to  the  Social  Security  number  of  another  individual  through  the  Internet; 

(2)  require  an  individual  who  is  customer  of  or  member  associated  with  such 
person  to  use  that  individual's  Social  Security  number  as  a  password  for  access 
to  any  good  or  service,  including  access  to  any  account  of  that  individual  or  any 
protected  access  website;  or 

(3)  display  the  Social  Security  number  of  any  individual  on  any  membership 
or  identity  card  issued  by  such  person. 

(b)  Enforcement. — ^A  violation  of  subsection  (a)  shall  be  treated  as  an  unfair  and 
deceptive  act  or  practice  in  violation  of  a  regulation  under  section  18(a)(1)(B)  of  the 
Federal  Trade  Commission  Act  (15  U.S.C.  57a(a)(l)(B))  regarding  unfair  or  decep- 
tive acts  or  practices.  The  Commission  shall  enforce  this  section  in  the  same  man- 
ner, by  the  same  means,  and  with  the  same  jurisdiction,  powers,  and  duties  as 
though  all  applicable  terms  and  provisions  of  the  Federal  Trade  Commission  Act  (15 
U.S.C.  41  et  seq.)  were  incorporated  into  and  made  a  part  of  this  section.  Any  per- 
son who  violates  subsection  (a)  shall  be  subject  to  the  penalties  and  entitled  to  the 
privileges  and  immunities  provided  in  that  Act. 

(c)  Exceptions. — Not  later  than  9  months  after  the  date  of  enactment  of  this  Act, 
the  Commission  shall  promulgate  rules  providing  for  any  exceptions  to  the  prohibi- 
tion in  subsection  (a)  for  circumstances  which  the  Commission  considers  appropriate 
and  consistent  with  the  public  interest,  the  protection  of  consumers,  and  the  pur- 
poses of  this  Act. 

SEC.  4.  regulation  OF  THE  SALE  AND  PURCHASE  OF  SOCIAL  SECURITY  NUMBERS. 

(a)  Prohibition. — It  shall  be  unlawful  for  any  person  to  sell  or  purchase  a  Social 
Security  number  in  a  manner  that  violates  a  regulation  promulgated  by  the  Com- 
mission under  subsection  (b)  of  this  section. 

(b)  Regulations.— 
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(1)  Restrictions  authorized.— The  Commission,  after  consultation  with  the 
Commissioner  of  Social  Security,  the  Attorney  General,  and  other  agencies  as 
the  Commission  deems  appropriate,  shall  promulgate  regulations  restricting  the 
sale  and  purchase  of  Social  Security  numbers  and  any  unfair  or  deceptive  acts 
or  practices  in  connection  with  the  sale  and  purchase  of  Social  Security  num- 
bers. 

(2)  Limitations  on  restrictions.— In  promulgating  such  regulations,  the 
Commission  shall  impose  restrictions  and  conditions  on  the  sale  and  purchase 
of  Social  Security  numbers  that  are  no  broader  than  necessary — 

(A)  to  provide  reasonable  assurance  that  Social  Security  numbers  will  not 
be  used  to  commit  or  facilitate  fraud,  deception,  or  crime;  and 

(B)  to  prevent  an  undue  risk  of  bodily,  emotional,  or  financial  harm  to 
individuals. 

For  purposes  of  subparagraph  (B),  the  Commission  shall  consider  the  nature, 
likelihood,  and  severity  of  the  anticipated  harm;  the  nature,  likelihood,  and  ex- 
tent of  any  benefits  that  could  be  realized  from  the  sale  or  purchase  of  the  num- 
bers; and  any  other  relevant  factors. 

(3)  Exceptions. — The  regulations  promulgated  pursuant  to  paragraph  (1) 
shall  include  exceptions  which  permit  the  sale  and  purchase  of  Social  Security 
numbers — 

(A)  to  the  extent  necessary  for  law  enforcement  or  national  security  pur- 
poses; 

(B)  to  the  extent  necessary  for  public  health  purposes; 

(C)  to  the  extent  necessary  in  emergency  situations  to  protect  the  health 
or  safety  of  1  or  more  individuals; 

(D)  to  the  extent  necessary  for  research  conducted  for  the  purpose  of  ad- 
vancing public  knowledge,  on  the  condition  that  the  researcher  provides 
adequate  assurances  that — 

(i)  the  Social  Security  numbers  will  not  be  used  to  harass,  target,  or 
publicly  reveal  information  concerning  any  identifiable  individuals; 

(ii)  information  about  identifiable  individuals  obtained  from  the  re- 
search will  not  be  used  to  make  decisions  that  directly  affect  the  rights, 
benefits,  or  privileges  of  specific  individuals;  and 

(iii)  the  researcher  has  in  place  appropriate  safeguards  to  protect  the 
privacy  and  confidentiality  of  any  information  about  identifiable  indi- 
viduals; 

(E)  to  the  extent  consistent  with  an  individual's  voluntary  and  affirmative 
written  consent  to  the  sale  or  purchase  of  a  Social  Security  number  that 
has  been  assigned  to  that  individual; 

(F)  to  the  extent  necessary  for  legitimate  consumer  credit  verification,  if 
the  Social  Security  numbers  used  for  such  verification  are  redacted  in  ac- 
cordance with  uniform  redaction  standards  established  by  the  Commission 
in  such  regulations;  and 

(G)  under  other  appropriate  circumstances  as  the  Commission  may  deter- 
mine and  as  are  consistent  with  the  principles  in  paragraph  (2). 

(c)  Rulemaking. — 

(1)  Deadline  for  action. — Not  later  than  1  year  after  the  date  of  enactment 
of  this  Act,  the  Commission  shall  promulgate  the  regulations  under  subsection 
(b)  of  this  section,  in  accordance  with  section  553  of  title  5,  United  States  Code. 

(2)  Effective  dates. — Subsection  (a)  and  the  regulations  promulgated  under 
subsection  (b)  shall  take  effect  30  days  after  the  date  on  which  the  final  regula- 
tions issued  under  this  section  are  published  in  the  Federal  Register. 

(d)  Enforcement. — Any  violation  of  a  regulation  promulgated  under  subsection 
(b)  of  this  section  shall  be  treated  as  a  violation  of  a  regulation  under  section 
18(a)(1)(B)  of  the  Federal  Trade  Commission  Act  (15  U.S.C.  57a(a)(l)(B))  regarding 
unfair  or  deceptive  acts  or  practices. 

(e)  Administration  and  Enforcement.— 

(1)  The  commission. — The  Commission  shall  prevent  any  person  from  vio- 
lating this  section,  and  any  regulation  promulgated  thereunder,  in  the  same 
manner,  by  the  same  means,  and  with  the  same  jurisdiction,  powers,  and  duties 
as  though  all  applicable  terms  and  provisions  of  the  Federal  Trade  Commission 
Act  (15  U.S.C.  41  et  seq.)  were  incorporated  into  and  made  a  part  of  this  Act. 
Any  person  who  violates  such  regulation  shall  be  subject  to  the  penalties  and 
entitled  to  the  privileges  and  immunities  provided  in  the  Federal  Trade  Com- 
mission Act  (15  U.S.C.  41  et  seq.)  as  though  all  applicable  terms  and  provisions 
of  the  Federal  Trade  Commission  Act  (15  U.S.C.  41  et  seq.)  were  incorporated 
into  and  made  a  part  of  this  Act.  Nothing  contained  in  this  Act  shall  be  con- 
strued to  limit  the  authority  of  the  Commission  under  any  other  provision  of 
law. 
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(2)  Actions  by  states. — 

(A)  Civil  actions. — In  any  case  in  which  the  attorney  general  of  a  State 
has  reason  to  beHeve  that  an  interest  of  the  residents  of  that  State  has 
been  or  is  threatened  or  adversely  affected  by  an  act  or  practice  that  vio- 
lates any  regulation  of  the  Commission  promulgated  under  subsection  (b), 
the  State,  as  parens  patriae,  may  bring  a  civil  action  on  behalf  of  the  resi- 
dents of  the  State  in  a  district  court  of  the  United  States  of  appropriate  ju- 
risdiction, to — 

(i)  enjoin  that  act  or  practice; 

(ii)  enforce  compliance  with  the  regulation; 

(iii)  obtain  civil  penalties  in  an  amount  of  $11,000  per  violation  not 
to  exceed  a  total  of  $5,000,000;  or 

(iv)  obtain  such  other  legal  and  equitable  relief  as  the  district  court 
may  consider  to  be  appropriate. 

Before  filing  an  action  under  this  subsection,  the  attorney  general  of  the 
State  involved  shall  provide  to  the  Commission  and  to  the  Attorney  General 
a  written  notice  of  that  action  and  a  copy  of  the  complaint  for  that  action. 
If  the  State  attorney  general  determines  that  it  is  not  feasible  to  provide 
the  notice  described  in  this  subparagraph  before  the  filing  of  the  action,  the 
State  attorney  general  shall  provide  the  written  notice  and  the  copy  of  the 
complaint  to  the  Commission  and  to  the  Attorney  General  as  soon  after  the 
filing  of  the  complaint  as  practicable. 

(B)  Commission  and  attorney  general  authority. — On  receiving  no- 
tice under  subparagraph  (A),  the  Commission  and  the  Attorney  General 
each  shall  have  the  right — 

(i)  to  move  to  stay  the  action,  pending  the  final  disposition  of  a  pend- 
ing Federal  matter  as  described  in  subparagraph  (c); 

(ii)  to  intervene  in  an  action  under  clause  (I); 

(iii)  upon  so  intervening,  to  be  heard  on  all  matters  arising  therein; 
and 

(iv)  to  file  petitions  for  appeal. 

(C)  Pending  criminal  proceedings.— If  the  Attorney  General  has  insti- 
tuted a  criminal  proceeding  or  the  Commission  has  instituted  a  civil  action 
for  a  violation  of  this  Act  or  any  regulations  thereunder,  no  State  may,  dur- 
ing the  pendency  of  such  proceeding  or  action,  bring  an  action  under  this 
section  against  any  defendant  named  in  the  criminal  proceeding  or  civil  ac- 
tion for  any  violation  of  this  section  that  is  alleged  in  that  proceeding  or 
action. 

(D)  Rule  of  construction. — For  purposes  of  bringing  any  civil  action 
under  subparagraph  (A),  nothing  in  this  Act  shall  be  construed  to  prevent 
an  attorney  general  of  a  State  from  exercising  the  powers  conferred  on  the 
attorney  general  by  the  laws  of  that  State  to  conduct  investigations,  admin- 
ister oaths  and  affirmations,  or  compel  the  attendance  of  witnesses  or  the 
production  of  documentary  and  other  evidence. 

(E)  Venue;  service  of  process. — Any  action  brought  under  this  section 
may  be  brought  in  any  district  court  of  the  United  States  that  meets  appli- 
cable requirements  relating  to  venue  under  section  1391  of  title  28,  United 
States  Code.  In  an  action  brought  under  this  section,  process  may  be  served 
in  any  district  in  which  the  defendant  is  an  inhabitant  or  may  be  found. 

SEC.  5.  STUDY  ON  FEASIBILITY  OF  BANNING  SOCIAL  SECURITY  AS  AN  AUTHENTICATOR. 

(a)  Study. — The  Commission  shall  conduct  a  study  to  determine — 

(1)  the  extent  of  the  use  of  Social  Security  numbers  as  a  primary  means  of 
authenticating  identity; 

(2)  the  extent  of  the  use  of  Social  Security  numbers  for  verification  in  com- 
mercial transactions;  and 

(3)  the  feasibility  of  a  prohibition  on  such  use. 

The  study  shall  also  examine  possible  alternatives  to  Social  Security  numbers  for 
verification  purposes  and  uses  in  authenticating  identity. 

(b)  Report. — The  Commission  shall  transmit  to  Congress  a  report  of  the  study, 
including  any  recommendations,  not  later  than  1  year  after  the  date  of  the  enact- 
ment of  this  Act. 

sec.  6.  effect  on  other  laws. 

This  Act  supersedes  any  provision  of  a  statute,  regulation,  or  rule  of  a  State  or 
political  subdivision  of  a  State  that  expressly — 

(1)  prohibits  the  uses  of  Social  Security  numbers  described  in  section  3(a);  or 

(2)  restricts  or  prohibits  the  sale  or  purchase  of  Social  Security  numbers  in 
a  manner  similar  to  the  regulations  promulgated  under  section  4(b). 
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PURPOSE  AND  SUMMARY 

The  purpose  of  H.R.  948,  the  Social  Security  Number  Protection 
Act  of  2007,  is  to  prohibit  the  pubhc  display  and  the  purchase  and 
sale  of  citizens'  Social  Security  numbers  in  interstate  commerce  in 
violation  of  rules  to  be  promulgated  by  the  Federal  Trade  Commis- 
sion (FTC).  H.R.  948  makes  it  unlawful  to  intentionally  display  So- 
cial Security  numbers  on  a  Web  site  or  to  provide  access  thereto 
through  the  Internet,  to  display  Social  Security  numbers  on  mem- 
bership or  identity  cards,  or  to  require  customers  to  use  Social  Se- 
curity numbers  as  passwords  for  access  to  any  goods  or  services, 
account,  or  protected  access  Web  site.  H.R.  948  also  requires  the 
FTC  to  promulgate  rules  within  one  year,  after  consultation  with 
the  Attorney  General  and  Commissioner  of  Social  Security,  restrict- 
ing the  sale  and  purchase  of  Social  Security  numbers.  The  regula- 
tions should  be  broad  enough  to  prevent  Social  Security  numbers 
from  being  used  to  commit  fraud,  deception,  or  crime,  and  prevent 
risk  of  bodily,  emotional,  or  financial  harm  to  individuals.  H.R.  948 
requires,  however,  certain  exemptions  from  the  prohibition  for  le- 
gitimate purposes  including  emergencies,  public  health,  and  law 
enforcement. 

BACKGROUND  AND  NEED  FOR  LEGISLATION 

Consumer  transactions  account  for  more  than  two-thirds  of  the 
U.S.  gross  domestic  product  at  this  time,  and  information  sharing 
is  of  particular  importance  to  the  U.S.  economy.  The  exchange  of 
information  among  businesses  is  linked  to  broad  economic  benefits, 
including  the  widespread  availability  and  low  cost  of  consumer 
credit,  based  in  part  upon  real  time  authentication  and  verification. 
Notwithstanding  the  benefits  of  information  sharing,  however,  con- 
sumers, businesses,  and  governmental  entities  have  begun  to  focus 
on  the  privacy  implications  of  information  practices.  The  same 
technological  advances  in  information  networks  that  benefit  con- 
sumers are  increasingly  misused  for  purposes  that  can  harm  con- 
sumers when  information  is  accessible  to  unauthorized  parties. 

Adopting  fair  information  practices  became  more  common  among 
businesses  in  the  mid  1990s.  The  common  elements  of  fair  informa- 
tion practices  are:  notice,  choice,  access,  security,  and  enforcement. 
There  is  wide  variance  in  the  extent  to  which  businesses  adhere  to 
these  information  practices.  Even  among  the  entities  that  have  em- 
braced these  fair  information  practices,  there  is  disagreement 
about  the  right  mix  of  self-regulation,  legislation,  and  technology  in 
protecting  privacy. 

Historically,  Congress  has  taken  a  sector-by-sector  approach  to 
privacy  and  has  mandated  discrete  protections  for  certain  personal 
information  used  for  commercial  purposes,  upon  a  showing  that  a 
particular  use  harmed  or  threatened  to  harm  the  American  con- 
sumer. This  industry-by-industry  approach  differs  from  the  com- 
prehensive approach  attempted  by  other  nations,  such  as  the  Euro- 
pean Union's  Data  Protection  Directive.  Together  those  sector  spe- 
cific statutes  encompass  a  significant  portion  of  U.S.  commercial 
activity,  though  they  are  significantly  different  in  the  protections 
afforded  to  consumers.  The  following  is  a  small  sample  of  Federal 
statutes  addressing  the  issue  of  information  privacy:  the  Children's 
Online  Privacy  Protection  Act,  the  Cable  Communications  Policy 
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Act,  the  Telecommunications  Act  of  1996,  the  Telephone  Consumer 
Protection  Act,  the  Electronic  Communications  Privacy  Act,  the 
Health  Insurance  Portability  Protection  Act,  the  Fair  Credit  Re- 
porting Act,  the  Gramm-Leach-Bliley  Act,  the  Family  Educational 
Rights  and  Privacy  Act,  the  Video  Privacy  Protection  Act,  the  Driv- 
er's Privacy  Protection  Act,  and  wiretap  statutes. 

The  need  to  address  privacy  concerns  has  grown  exponentially 
with  the  prevalence  of  digitized  personal  information  that  can  be 
stored,  transferred,  and  theoretically  accessed  by  limitless  parties 
depending  on  the  data  safeguards  or  protections.  Such  information 
sharing  may  require  the  authentication  and  validation  of  individ- 
uals' identities.  In  many  cases,  individuals'  Social  Security  num- 
bers have  become  the  default  identifier. 

Originally  created  by  the  Federal  Government  to  administer  the 
Social  Security  program,  the  numbers  were  intended  only  to  track 
employee  contributions  to  the  system  and  administer  benefits  but 
were  prohibited  from  any  other  use.  Congress  later  authorized  the 
use  of  Social  Security  numbers  as  taxpayer  identification  numbers 
for  the  IRS.  Over  time,  however,  the  numbers  have  become  default 
identification  and  verification  for  many  other  purposes.  The  Fed- 
eral Government  requires  virtually  every  individual  in  the  United 
States  to  obtain  and  maintain  a  Social  Security  number  in  order 
to  pay  taxes,  to  qualify  for  Social  Security  benefits,  or  to  seek  em- 
ployment. An  unintended  consequence  of  these  requirements  is 
that  Social  Security  numbers  have  become  tools  that  can  be  used 
to  facilitate  crime,  fraud,  and  invasions  of  the  privacy  of  the  indi- 
viduals to  whom  the  numbers  are  assigned.  Because  the  Federal 
Government  created  and  maintains  this  system,  and  because  the 
Federal  Government  does  not  permit  persons  to  exempt  themselves 
from  those  requirements,  the  Committee  finds  it  is  appropriate  for 
the  Government  to  take  steps  to  stem  the  abuse  of  this  system. 

The  Committee  notes  that  Congress  attempted  to  limit  the  use 
of  Social  Security  numbers  with  the  passage  of  the  Privacy  Act  of 
1974.  This  law  applied  only  to  government  agencies,  however,  and 
did  not  restrict  the  private  sector.  As  a  result  of  the  lack  of  restric- 
tions. Social  Security  numbers  have  become  s3nionymous  with  an 
individual's  identity  as  the  number  is  tied  directly  to  nearly  all  fi- 
nancial accounts,  as  well  as  patient  records  of  health-care  providers 
and  other  business  entities.  While  there  are  clear  benefits  associ- 
ated with  the  ability  to  authenticate  and  verify  an  individual — in- 
cluding the  provision  of  instantaneous  credit,  combating  fraudulent 
transactions,  and  accurately  identifying  or  locating  individuals 
whose  name  has  changed  and  is  otherwise  unable  to  be  located — 
the  Social  Security  number  has  become  the  singularly  most  impor- 
tant means  of  identifying  and  authenticating  an  individual,  in- 
creasing its  value  in  the  eyes  of  identity  thieves  and  fraudsters. 

The  Committee  finds  that  the  inappropriate  sale  or  purchase  of 
Social  Security  numbers  is  a  significant  factor  in  a  growing  range 
of  illegal  activities,  including  fraud,  identity  theft,  and,  in  some 
cases,  stalking  and  other  violent  crimes.  It  is  the  identifying  infor- 
mation associated  with  a  Social  Security  number  that  presents  the 
largest  potential  threats  to  individuals.  Because  an  individual's  in- 
formation is  linked  to  the  Social  Security  number,  access  to  the  So- 
cial Security  number  opens  the  individuals'  identity  and  related  in- 
formation to  the  possibility  of  the  information  being  available  to 
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unauthorized  parties  or  for  unauthorized  purposes.  The  Committee 
found  that  this  can  faciKtate  the  commission  of  criminal  activities 
and  also  can  result  in  serious  invasions  of  individual  privacy. 

The  Committee  seeks  to  stop  the  unauthorized  access  to  and  use 
of  an  individual's  Social  Security  number  as  a  result  of  a  commer- 
cial transaction  to  purchase  or  sell  the  numbers.  For  example,  iden- 
tity theft  crimes  have  risen  substantially  over  the  past  decade  in 
part  because  Social  Security  numbers  and  other  information  nec- 
essary to  perpetrate  the  crime  are  often  easily  available  for  pur- 
chase by  potential  criminals.  The  Committee's  related  investigation 
into  the  practice  of  pretexting — fraudulently  impersonating  some- 
one else  to  acquire  detailed  information  (usually  over  the  phone) 
about  another  person — demonstrated  that  access  to  an  individual's 
personal  information  is  often  only  limited  to  the  provision  of  a  So- 
cial Security  number.  Once  a  Social  Security  number  is  obtained, 
access  to  detailed  personal  information  associated  with  the  Social 
Security  number  is  readily  accessible.  With  this  information  in 
hand,  a  criminal  can  commit  identity  theft  in  numerous  ways,  in- 
cluding opening  new  accounts  in  the  name  of  the  individual  at- 
tached to  the  Social  Security  number. 

Although  account  fraud  is  one  of  the  most  common  crimes  per- 
petrated by  criminals,  the  Committee  is  aware  of  other  harm,  in- 
cluding violent  crimes,  that  can  occur  when  Social  Security  num- 
bers are  easily  available  for  purchase.  The  Committee  is  concerned 
the  range  of  harms  and  crimes  that  can  be  perpetrated  will  only 
increase  if  prohibitions  are  not  enacted  to  restrict  the  proliferation 
of  the  commercial  availability  of  individuals'  Social  Security  num- 
bers. No  one  should  seek  to  profit  from  the  sale  of  Social  Security 
numbers.  Consequently,  there  is  a  need  for  enactment  of  legislation 
that  will  offer  individuals  assigned  such  numbers  necessary  protec- 
tions from  the  public  display  or  the  sale  and  purchase  of  Social  Se- 
curity numbers  in  circumstances  that  might  facilitate  unlawful  con- 
duct or  that  might  otherwise  likely  result  in  unfair  or  deceptive 
practices.  The  Committee  observes  that  the  Office  of  Management 
and  Budget  recently  released  a  memorandum  advising  Federal  de- 
partments and  agencies  to  review  their  use  of  Social  Security  num- 
bers and  come  up  with  a  plan  in  120  days  to  eliminate  their  unnec- 
essary collection  and  use  within  18  months.  Action  on  the  Commit- 
tee's bipartisan  legislation  is  critical  and  timely. 

HEARINGS 

No  hearings  were  held  on  H.R.  948  this  year.  However,  in  the 
109th  Congress,  the  Subcommittee  on  Commerce,  Trade,  and  Con- 
sumer Protection  held  a  hearing  on  Thursday,  May  11,  2006  enti- 
tled "Social  Security  Numbers  in  Commerce:  Reconciling  Beneficial 
Uses  with  Threats  to  Privacy"  which  examined  H.R.  1078,  substan- 
tially similar  legislation  considered  in  the  109th  Congress,  as  well 
as  other  legislative  proposals  to  increase  privacy  protections  for  So- 
cial Security  numbers.  Testimony  was  received  from  the  following: 
The  Honorable  Jon  Leibowitz,  Commissioner,  Federal  Trade  Cora- 
mission;  Mr.  Oliver  1.  Ireland,  Partner,  Morrison  &  Foerster,  testi- 
fying on  behalf  of  the  Financial  Services  Industry  Association;  Ms. 
Susan  McDonald,  President,  Pension  Benefit  Information;  Ms. 
Lauren  Steinfeld,  Former  Associate  Chief  Counsel,  Office  of  Man- 
agement and  the  Budget,  Mr.  H.  Randy  Lively  Jr.,  President  and 
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CEO,  American  Financial  Services  Association;  and  Mr.  Marc 
Rotenberg,  Executive  Director,  Electronic  Privacy  Information  Cen- 
ter. 

COMMITTEE  CONSIDERATION 

On  Wednesday,  May  10,  2007,  the  Committee  on  Energy  and 
Commerce  met  in  open  markup  session  and  ordered  H.R.  948  fa- 
vorably reported  to  the  House,  amended,  by  a  voice  vote,  a  quorum 
being  present. 

COMMITTEE  VOTES 

Clause  3(b)  of  rule  XIII  of  the  Rules  of  the  House  of  Representa- 
tives requires  the  Committee  to  list  the  record  votes  on  the  motion 
to  report  legislation  and  amendments  thereto.  There  were  no 
record  votes  taken  in  connection  with  ordering  H.R.  948  reported. 
A  motion  by  Mr.  Dingell  to  order  H.R.  948  reported  to  the  House, 
amended,  was  agreed  to  by  a  voice  vote. 

COMMITTEE  OVERSIGHT  FINDINGS 

Pursuant  to  clause  3(c)(1)  of  rule  XIII  of  the  Rules  of  the  House 
of  Representatives,  the  oversight  findings  of  the  Committee  are  re- 
flected in  the  preceding  portions  of  this  report. 

STATEMENT  OF  GENERAL  PERFORMANCE  GOALS  AND  OBJECTIVES 

The  purpose  of  the  legislation  is  to  reduce  harm  to  individuals 
that  results  from  the  public  display  or  the  purchase  or  sale  of  their 
Social  Security  number. 

NEW  BUDGET  AUTHORITY,  ENTITLEMENT  AUTHORITY,  AND  TAX 
EXPENDITURES 

Regarding  compliance  with  clause  3(c)(2)  of  rule  XIII  of  the  Rules 
of  the  House  of  Representatives,  the  Committee  finds  that  H.R. 
948,  the  Social  Security  Number  Protection  Act  of  2007,  would  re- 
sult in  no  new  or  increased  budget  authority,  entitlement  author- 
ity, or  tax  expenditures  or  revenues. 

EARMARKS  AND  TAX  AND  TARIFF  BENEFITS 

Regarding  compliance  with  clause  9  of  rule  XXI  of  the  Rules  of 
the  House  of  Representatives,  H.R.  948  does  not  contain  any  Con- 
gressional earmarks,  limited  tax  benefits,  or  limited  tariff  benefits 
as  defined  in  clause  9(d),  9(e),  or  9(f)  of  rule  XXI. 

COMMITTEE  COST  ESTIMATE 

The  Committee  adopts  as  its  own  the  cost  estimate  prepared  by 
the  Director  of  the  Congressional  Budget  Office  pursuant  to  section 
402  of  the  Congressional  Budget  Act  of  1974. 

CONGRESSIONAL  BUDGET  OFFICE  ESTIMATE 

Pursuant  to  clause  3(c)(3)  of  rule  XIII  of  the  Rules  of  the  House 
of  Representatives,  the  following  is  the  cost  estimate  provided  by 
the  Congressional  Budget  Office  pursuant  to  section  402  of  the 
Congressional  Budget  Act  of  1974: 


9 


May  25,  2007. 

Hon.  John  D.  Dingell, 

Chairman,  Committee  on  Energy  and  Commerce, 
House  of  Representatives,  Washington,  DC. 

Dear  Mr.  Chairman:  The  Congressional  Budget  Office  has  pre- 
pared the  enclosed  cost  estimate  for  H.R.  948,  the  Social  Security 
Number  Protection  Act  of  2007. 

If  you  wish  further  details  on  this  estimate,  we  will  be  pleased 
to  provide  them.  The  CBO  staff  contact  is  Susan  Willie. 
Sincerely, 

Peter  R.  Orszag. 

Enclosure. 

H.R.  948 — Social  Security  Number  Protection  Act  of  2007 

Summary:  H.R.  948  would  prohibit  the  sale  or  purchase  of  Social 
Security  numbers  (SSNs)  as  well  as  certain  other  activities  related 
to  their  display  or  use.  The  Federal  Trade  Commission  (FTC) 
would  be  required  to  develop  regulations  to  enforce  the  new  prohi- 
bitions. CBO  estimates  that  promulgating  and  enforcing  those  reg- 
ulations would  not  have  a  significant  effect  on  federal  spending. 

Enacting  the  bill  could  increase  federal  revenues  from  civil  pen- 
alties assessed  for  violations  of  the  new  regulations,  but  CBO  esti- 
mates that  any  such  increase  would  not  be  significant  in  any  year. 
Enacting  the  bill  would  not  affect  direct  spending. 

H.R.  948  contains  intergovernmental  mandates  as  defined  in  the 
Unfunded  Mandates  Reform  Act  (UMRA).  The  bill  would  preempt 
state  and  local  laws  that  restrict  the  use,  sale,  or  purchase  of  Social 
Security  numbers,  but  CBO  estimates  that  the  costs  of  those  man- 
dates would  be  small  and  would  not  exceed  the  threshold  estab- 
hshed  in  UMRA  ($66  milHon  in  2007,  adjusted  annually  for  infla- 
tion). 

H.R.  948  would  impose  private-sector  mandates  as  defined  in  the 
UMRA.  It  would  prohibit  any  entity  in  the  private  sector  from  sell- 
ing or  purchasing  a  Social  Security  number  in  violation  of  the  regu- 
lations that  the  Federal  Trade  Commission  would  issue.  The  bill 
also  would  prohibit  certain  uses  of  Social  Security  numbers.  The 
cost  to  the  private  sector  of  complying  with  those  mandates  is  un- 
certain because  it  would  depend  on  regulations  that  have  not  yet 
been  promulgated.  Therefore,  CBO  cannot  determine  whether  the 
aggregate  cost  of  mandates  in  the  bill  would  exceed  the  annual 
threshold  established  by  UMRA  for  private  sector  mandates  ($131 
million  in  2007,  adjusted  annually  for  inflation). 

Estimated  cost  to  the  Federal  Government:  H.R.  948  would  make 
it  illegal  to  display  an  individual's  SSN  on  a  public  Web  site  or  on 
a  membership  or  identity  card,  to  require  the  use  of  a  SSN  as  a 
password  for  access  to  services,  or  to  sell  or  purchase  SSNs.  The 
bill  would  require  the  FTC  to  develop  and  enforce  those  new  prohi- 
bitions. 

Based  on  information  from  the  FTC,  CBO  estimates  that  the  cost 
to  develop  regulations  limiting  the  display  and  use  of  SSNs  as  well 
as  their  sale  and  purchase  would  be  less  than  $500,000  per  year. 
Such  costs  would  be  subject  to  the  availability  of  appropriated 
funds.  The  costs  of  this  legislation  would  fall  within  budget  func- 
tion 370  (commerce  and  housing  credit). 
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Enacting  H.R.  948  could  increase  federal  revenues  from  civil  pen- 
alties assessed  for  violations  of  the  new  regulations.  CBO  esti- 
mates, however,  that  any  additional  revenues  that  would  result 
from  enacting  the  bill  would  not  be  significant  because  of  the  rel- 
atively small  number  of  cases  likely  to  be  involved. 

Estimated  impact  on  state,  local,  and  tribal  governments:  H.R. 
948  contains  intergovernmental  mandates  as  defined  in  UMRA.  In 
particular,  the  bill  would  require  state  attorneys  general  to  notify 
the  FTC  of  any  action  taken  under  the  bill,  allow  the  FTC  to  inter- 
vene in  those  actions,  and  limit  the  actions  that  attorneys  general 
may  take  in  certain  circumstances.  Also,  provisions  regarding  the 
use,  sale,  or  purchase  of  Social  Security  numbers  would  preempt 
state  laws.  CBO  estimates  that  the  aggregate  costs,  if  any,  to  state, 
local,  and  tribal  governments  of  complying  with  the  mandates  in 
the  bill  would  be  small  and  would  not  exceed  the  threshold  estab- 
hshed  in  UMRA  ($66  milhon  in  2007,  adjusted  annually  for  infla- 
tion). 

CBO  believes  that  the  bill  would  grant  no  new  authority  to  the 
FTC  to  regulate  the  activities  of  state  and  local  governments. 
Under  current  law,  the  courts  have  ruled  that  the  FTC  does  not 
have  jurisdiction  over  those  governments  or  over  public  univer- 
sities. Furthermore,  the  bill's  provisions  apply  to  "persons,"  a  term 
that  does  not  include  sovereigns  such  as  state,  local,  or  tribal  gov- 
ernments. We  expect,  therefore,  that  the  provisions  of  the  bill  re- 
garding the  use,  sale,  and  purchase  of  Social  Security  numbers 
would  not  apply  to  such  entities. 

Estimated  impact  on  the  private  sector:  H.R.  948  contains  pri- 
vate-sector mandates  as  defined  in  UMRA.  It  would  prohibit  any 
entity  from  selling  or  purchasing  a  Social  Security  number  (SSN) 
in  violation  of  regulations  that  the  FTC  would  issue  to  implement 
this  legislation.  The  bill  also  would  prohibit  the  display  of  Social 
Security  numbers  on  any  Web  site  that  is  generally  accessible  to 
the  public  or  on  any  membership  or  identity  cards.  In  addition,  the 
bill  would  prohibit  anyone  from  requiring  that  a  consumer  use  a 
Social  Security  number  as  a  password.  The  FTC  would  be  required 
to  ensure  that  the  restrictions  and  conditions  on  the  sale  or  pur- 
chase of  SSNs  are  no  broader  than  necessary  to  provide  reasonable 
assurance  that  SSNs  will  not  be  used  to  commit  or  facilitate  fraud, 
deception,  or  crime,  and  to  prevent  an  undue  risk  of  bodily,  emo- 
tional, or  financial  harm  to  individuals. 

H.R.  948  is  aimed  at  prohibiting  activities  that  have  no  legiti- 
mate purpose;  however,  despite  the  exemptions  in  the  bill,  some 
entities  engaging  in  legitimate  activities  might  be  forced  to  change 
their  business  practices  as  a  result  of  the  legislation.  The  cost  to 
the  private  sector  of  compljdng  with  the  mandates  in  the  bill  is  un- 
certain because  it  would  depend  on  regulations  that  have  not  yet 
been  promulgated.  Consequently,  CBO  cannot  determine  whether 
the  aggregate  cost  of  mandates  in  H.R.  948  would  exceed  the  an- 
nual threshold  established  by  UMRA  for  private-sector  mandates 
($131  million  in  2007,  adjusted  annually  for  inflation). 

Estimate  prepared  by:  Federal  Costs:  Susan  Willie;  Impact  on 
state,  local,  and  tribal  governments:  Elizabeth  Cove;  Impact  on  the 
private  sector:  Fatimot  Ladipo. 

Estimate  approved  by:  Robert  A.  Sunshine,  Assistant  Director  for 
Budget  Analysis. 
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FEDERAL  MANDATES  STATEMENT 

The  Committee  adopts  as  its  own  the  estimate  of  Federal  man- 
dates prepared  by  the  Director  of  the  Congressional  Budget  Office 
pursuant  to  section  423  of  the  Unfunded  Mandates  Reform  Act. 

ADVISORY  COMMITTEE  STATEMENT 

No  advisory  committees  within  the  meaning  of  section  5(b)  of  the 
Federal  Advisory  Committee  Act  were  created  by  this  legislation. 

CONSTITUTIONAL  AUTHORITY  STATEMENT 

Pursuant  to  clause  3(d)(1)  of  rule  XIII  of  the  Rules  of  the  House 
of  Representatives,  the  Committee  finds  that  the  Constitutional  au- 
thority for  this  legislation  is  provided  in  Article  I,  section  8,  clause 
3,  which  grants  Congress  the  power  to  regulate  commerce  with  for- 
eign nations,  among  the  several  States,  and  with  the  Indian  Tribes. 

APPLICABILITY  TO  LEGISLATIVE  BRANCH 

The  Committee  finds  that  the  legislation  does  not  relate  to  the 
terms  and  conditions  of  employment  or  access  to  public  services  or 
accommodations  within  the  meaning  of  section  102(b)(3)  of  the  Con- 
gressional Accountability  Act. 

SECTION-BY-SECTION  ANALYSIS  OF  THE  LEGISLATION 

Section  1.  Short  title 

Section  1  defines  this  Act  as  the  "Social  Security  Protection  Act 
of  2007". 

Section  2.  Definitions 

Section  2  defines  terms  to  be  used  in  this  Act:  including,  "Com- 
mission," "person,"  "sale,"  "purchase,"  "Social  Security  number," 
and  "State." 

The  terms  "sale"  and  "purchase"  are  broadly  defined  to  include, 
respectively,  obtaining  or  providing,  directly  or  indirectly,  anything 
of  value  in  exchange  for  a  Social  Security  number.  Both  of  the  lat- 
ter terms,  "sale"  and  "purchase,"  are  specifically  defined  to  exclude 
two  sets  of  circumstances:  (1)  the  submission  of  such  numbers  as 
part  of  the  process  for  applying  for  any  type  of  government  benefit 
or  program  (e.g.,  grant  or  loan  applications  or  welfare  or  other  pub- 
lic assistance  programs);  and  (2)  the  transfers  of  such  numbers  as 
part  of  a  data  matching  program  under  the  Computer  Matching 
and  Privacy  Protection  Act  of  1988.  The  term  "State"  is  defined 
broadly  to  include  both  States  of  the  United  States  and  other  polit- 
ical subdivisions  of  the  United  States,  such  as  its  territories  and 
possessions. 

Section  3.  Prohibition  on  certain  uses  of  social  security  numbers 

Section  3  prohibits  the  use  of  Social  Security  numbers  in  specific 
circumstances,  except  as  provided  under  regulations  promulgated 
by  the  FTC.  Subsection  3(a)(1)  would  make  it  unlawful  for  any  per- 
son to  intentionally  display  the  Social  Security  number  of  another 
individual  on  a  Web  site  that  is  generally  accessible  to  the  public 
or  provide  an  individual  with  access  to  the  Social  Security  number 
of  another  individual  through  the  Internet.  Subsection  3(a)(2) 
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would  make  it  unlawful  to  require  an  individual  who  is  a  customer 
of  or  member  associated  with  such  person  to  use  that  individual's 
Social  Security  number  as  a  password  for  access  to  any  good  or 
service,  including  access  to  any  account  of  that  individual  or  any 
protected  access  website.  Subsection  3(a)(3)  would  make  it  unlawful 
to  display  the  Social  Security  number  of  any  individual  on  any 
membership  or  identity  card  issued  by  such  person.  Subsection  3(b) 
stipulates  that  a  violation  of  subsection  (a)  shall  be  treated  as  an 
unfair  and  deceptive  act  or  practice  under  section  18(a)(1)(B)  of  the 
Federal  Trade  Commission  Act.  Any  person  who  violates  subsection 
(a)  shall  be  subject  to  the  penalties  and  entitled  to  the  privileges 
and  immunities  provided  in  the  Federal  Trade  Commission  Act. 
Subsection  3(c)  directs  the  FTC  to  promulgate  rules  that  provide 
for  any  exceptions  to  the  prohibitions  in  subsection  (a)  for  cir- 
cumstances that  the  FTC  considers  appropriate  and  consistent  with 
the  public  interest,  the  protection  of  consumers,  and  the  purposes 
of  this  Act.  The  Committee  understands  that  access  to  Social  Secu- 
rity numbers  is  essential  to  many  vital  government  and  commercial 
operations,  such  as  database  accuracy  and  fraud  prevention.  The 
Committee  believes,  however,  that  there  is  no  legitimate  reason 
why,  for  example,  Web  site  operators  should  be  displaying,  pro- 
viding access  to,  or  selling  Social  Security  numbers  to  the  general 
public.  The  intent  of  this  section  is  to  stop  the  public  display  of  So- 
cial Security  numbers.  The  Committee  believes  that  such  activity 
poses  a  substantial  threat  to  consumers  of  identity  theft  and  finan- 
cial account  fraud. 

Section  4.  Regulation  of  the  sale  and  purchase  of  social  security 
numbers 

Section  4  provides  for  the  prohibition  of  the  sale  or  purchase  of 
Social  Security  numbers  in  violation  of  regulations  promulgated  by 
the  FTC.  The  FTC  shall  promulgate  regulations  within  one  year  of 
enactment  restricting  the  sale  and  purchase  and  defining  unfair 
and  deceptive  acts  related  to  the  sale  and  purchase  of  Social  Secu- 
rity numbers.  The  FTC  regulations  shall  also  include  exceptions  for 
certain  enumerated  purposes  consistent  with  the  intent  of  the  leg- 
islation. 

Subsection  4(a)  would  establish  the  general  prohibition  of  the 
sale  and  purchase  of  a  Social  Security  number  in  a  manner  that 
violates  a  regulation  promulgated  by  the  FTC  under  subsection  (b). 
Subsection  4(b)(1)  would  direct  the  FTC,  after  consultation  with  the 
Commissioner  of  Social  Security,  the  Attorney  General,  and  other 
agencies  as  the  FTC  deems  appropriate,  to  promulgate  regulations 
restricting  the  sale  and  purchase  of  Social  Security  numbers  and 
any  unfair  and  deceptive  acts  and  practices  in  connection  with  the 
sale  and  purchase  of  those  numbers.  Subsection  4(b)(2)  would  re- 
quire the  FTC  to  impose  restrictions  and  conditions  on  the  sale  and 
purchase  of  Social  Security  numbers  and  Social  Security  account 
numbers  that  are  no  broader  than  necessary  (A)  to  provide  reason- 
able assurance  that  such  numbers  will  not  be  used  to  commit  or 
facilitate  fraud,  deception,  or  crime;  and  (B)  to  prevent  an  undue 
risk  of  bodily,  emotional,  or  financial  harm  to  individuals  (taking 
into  account  the  nature,  likelihood,  and  severity  of  the  anticipated 
harm  and  the  extent  of  any  benefits  that  might  be  realized  from 
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the  sale  or  purchase  of  the  numbers  and  any  other  relevant  fac- 
tors). 

Subsection  4(b)(3)  would  require  the  FTC  to  establish  in  those 
regulations  exceptions  for  seven  categories  of  situations  in  which 
the  sale  and  purchase  of  Social  Security  numbers  would  be  per- 
mitted: (1)  to  the  extent  necessary  for  law  enforcement  or  national 
security  purposes;  (2)  to  the  extent  necessary  for  public  health  pur- 
poses; (3)  to  the  extent  necessary  in  emergency  situations  to  protect 
the  health  and  safety  of  one  or  more  individuals;  (4)  to  the  extent 
necessary  for  research  to  advance  public  knowledge  (including,  but 
not  limited  to,  scientific,  epidemiological,  and  social  scientific  re- 
search) conducted  for  the  purpose  of  advancing  public  knowledge, 
on  the  condition  that  for  such  research  the  researcher  provides  ade- 
quate assurances  that  (i)  the  Social  Security  numbers  will  not  be 
used  to  harass,  target,  or  publicly  reveal  information  concerning 
any  identifiable  individual(s);  (ii)  information  about  identifiable  in- 
dividuals obtained  from  the  research  will  not  be  used  to  make  deci- 
sions that  directly  affect  the  rights,  benefits,  or  privileges  of  spe- 
cific individuals;  and  (iii)  the  researcher  has  in  place  appropriate 
safeguards  to  protect  the  privacy  and  confidentiality  of  any  infor- 
mation about  identifiable  individuals;  (5)  to  the  extent  consistent 
with  an  individual's  voluntary  and  affirmative  written  consent  to 
the  sale  or  purchase  of  a  particular  Social  Security  number  that 
has  been  assigned  to  that  individual;  (6)  to  the  extent  necessary  for 
legitimate  consumer  credit  verification,  if  the  Social  Security  num- 
bers used  for  such  verification  are  redacted  in  accordance  with  uni- 
form redaction  standards  issued  by  the  FTC  in  such  regulations, 
and  (7)  under  other  appropriate  circumstances  as  the  FTC  may  de- 
termine and  as  are  consistent  with  the  paragraph  (2).  Under  any 
of  these  seven  exceptions,  when  Federal  departments  and  agencies 
have  Social  Security  numbers  in  systems  of  records,  the  legal  pro- 
tections of  the  Privacy  Act,  5  U.S.C.  §  552a,  will  apply. 

The  Committee  intends  that  the  FTC's  regulations  will  address, 
among  other  things,  growing  concerns  about  the  ability  of  compa- 
nies to  demand  that  consumers  provide  them  with  a  full  Social  Se- 
curity number  as  a  condition  of  doing  business.  The  Committee  in- 
tends that  the  FTC,  in  crafting  uniform  redaction  standards  pursu- 
ant to  4(b)(3)(F),  shall  protect  against  the  threat  that  a  persons' 
full  Social  Security  number  could  be  uncovered.  For  example,  such 
standards  shall  protect  against  the  threat  that  a  person's  full  So- 
cial Security  number  could  be  identified  by  combining  the  redacted 
number  with  other  data  which  might  otherwise  reasonably  be 
available  about  the  individual  and  which  could  facilitate  replication 
of  the  full  number,  such  as  the  individual's  date  of  birth  or  place 
of  birth. 

Subsection  4(c)(1)  would  direct  the  FTC  to  promulgate  the  regu- 
lations under  subsection  4(b)  not  later  than  one  year  after  the  date 
of  enactment  of  the  bill.  Subsection  4(a),  and  regulations  promul- 
gated under  subsection  4(b),  shall  take  effect  thirty  days  after  the 
date  on  which  the  final  regulations  issued  under  subsection  4(b) 
are  published  in  the  Federal  Register.  Subsection  4(d)  would  direct 
that  any  violation  of  a  regulation  promulgated  under  subsection 
4(b)  shall  be  treated  as  a  violation  of  a  regulation  under  section 
18(a)(1)(B)  of  the  Federal  Trade  Commission  Act  (15  U.S.C. 
§57a(a)(l)(B))  regarding  unfair  or  deceptive  acts  or  practices. 
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Subsection  4(e)(1)  would  set  forth  the  FTC's  authority  to  prevent 
violations  of  Section  3  and  the  regulations  promulgated  under  Sec- 
tion 4,  and  provide  that  violators  of  such  rules  shall  be  subject  to 
the  penalties,  and  entitled  to  the  privileges  and  immunities  pro- 
vided in  the  Federal  Trade  Commission  Act  as  though  all  applica- 
ble terms  and  provisions  of  that  Act  were  incorporated  into  and 
made  a  part  of  this  bill.  Subsection  4(e)(2)  would  authorize  any 
State  attorney  general  to  bring  a  parens  patriae  action  in  a  United 
States  district  court,  in  any  case  in  which  that  attorney  general  has 
reason  to  believe  that  an  interest  of  the  residents  of  that  State  has 
been  or  is  threatened  or  adversely  affected  by  an  act  or  practice 
that  violates  any  regulation  under  Section  4(b)  of  the  Act.  The  re- 
lief that  the  State  attorney  general  may  seek  would  include  injunc- 
tive relief,  enforcement  of  compliance  with  the  regulation,  obtain- 
ing damages,  restitution,  and  other  compensation  on  behalf  of  the 
State's  residents  (including  civil  penalties  up  to  $11,000  per  viola- 
tion, not  to  exceed  a  maximum  of  $5,000,000)  and  any  other  legal 
or  equitable  relief  as  the  district  court  may  consider  to  be  appro- 
priate. This  subsection  also  contains  provisions  for  notice  to  the 
FTC  and  the  Department  of  Justice  when  such  actions  are  brought; 
litigation-related  rights  that  the  FTC  and  the  Department  each 
would  have  in  such  actions;  a  provision  precluding  States  from  fil- 
ing such  parens  patriae  actions  if  the  Department  has  instituted  a 
prosecution  for  criminal  violations  or  the  FTC  has  instituted  civil 
litigation  for  civil  violations  of  the  Act;  a  provision  clarifying  the 
ability  of  a  State  attorney  general  to  use  investigatory  powers 
under  the  laws  of  that  State;  and  procedural  provisions  for  venue 
and  service  of  process. 

Section  5.  Study  of  feasibility  of  banning  social  security  as  an  au- 
thenticator 

Section  5  directs  the  FTC  to  conduct  a  study  to  determine:  (1)  the 
extent  of  the  use  of  Social  Security  numbers  as  a  primary  means 
of  authenticating  identity;  (2)  the  extent  of  the  use  of  Social  Secu- 
rity numbers  for  verification  in  commercial  transactions;  (3)  the 
feasibility  of  a  prohibition  on  such  use;  and  (4)  possible  alternatives 
to  Social  Security  numbers  for  verification  purposes  and  uses  in  au- 
thenticating identity.  The  FTC  shall  transmit  to  Congress  a  report 
of  the  study,  including  recommendations,  no  later  than  one  year 
after  the  date  of  enactment  of  this  Act. 

Section  6.  Effect  on  other  laws 

Section  6  preempts  any  State  laws  that  expressly:  (1)  prohibits 
the  uses  of  Social  Security  numbers  described  in  Section  3(a);  or  (2) 
restricts  or  prohibits  the  sale  or  purchase  of  Social  Security  num- 
bers in  a  manner  similar  to  the  regulations  promulgated  under 
Section  4(b). 

CHANGES  IN  EXISTING  LAW  MADE  BY  THE  BILL,  AS  REPORTED 

H.R.  948  does  not  amend  any  existing  Federal  statute. 
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